PT-2023-9016 · Tenda · Tenda Ac23

Dengxiquan · Published 2023-05-11 · Updated 2024-05-17 · CVE-2023-2649

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC23 version 16.03.07.45 cn

Description The issue is related to insufficient argument checking in the Service Port 7329 component of the Tenda AC23 router's firmware, which can lead to command injection. This can be exploited by a remote attacker to execute arbitrary commands. The manipulation of the v2 argument is the key to this vulnerability. The attack can be initiated remotely.

Recommendations For Tenda AC23 version 16.03.07.45 cn, as a temporary workaround, consider restricting access to the Service Port 7329 component until a patch is available. Avoid using the v2 argument in the affected command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-03021

CVE-2023-2649

Affected Products

Tenda Ac23

References · 8

• 🔥 https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2649 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2649 · Security Note
• https://vuldb.com/?ctiid.228778 · Note
• https://t.me/cibsecurity/63865 · Telegram Post
• https://t.me/cvenotify/50828 · Telegram Post
• https://vuldb.com/?id.228778 · Note